CVE-2025-6802: Marvell QConvergeConsole RCE Vulnerability

CVE-2025-6802 Overview

CVE-2025-6802 is a critical unrestricted file upload vulnerability affecting Marvell QConvergeConsole. This vulnerability allows remote attackers to execute arbitrary code on affected installations without requiring authentication. The flaw exists within the implementation of the getFileFromURL method, where improper validation of user-supplied data permits the upload of arbitrary files. Successful exploitation enables attackers to execute code in the context of SYSTEM, resulting in complete system compromise.

Critical Impact

Unauthenticated remote attackers can achieve SYSTEM-level code execution through arbitrary file upload, enabling complete compromise of affected systems running Marvell QConvergeConsole.

Affected Products

• Marvell QConvergeConsole (all versions)

Discovery Timeline

• 2025-07-07 - CVE-2025-6802 published to NVD
• 2025-07-14 - Last updated in NVD database

Technical Details for CVE-2025-6802

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The getFileFromURL method in Marvell QConvergeConsole fails to properly validate user-supplied data before processing file uploads. This lack of validation allows attackers to upload files with arbitrary content and extensions to the target system.

The vulnerability is particularly severe because it requires no authentication to exploit and operates over the network. Once an attacker successfully uploads a malicious file, such as a web shell or executable, they can achieve code execution with SYSTEM privileges—the highest privilege level on Windows systems.

Root Cause

The root cause stems from insufficient input validation in the getFileFromURL method implementation. The application does not properly sanitize or validate:

• The URL parameter supplied by users
• The content type of uploaded files
• The destination path where files are written
• File extensions that could indicate dangerous file types

This allows attackers to bypass any intended restrictions and upload arbitrary files to the server, including executable code.

Attack Vector

The attack can be executed remotely over the network without any user interaction or prior authentication. An attacker can craft a malicious request to the getFileFromURL endpoint that causes the application to fetch and store an attacker-controlled file. The attacker hosts a malicious payload (such as a JSP web shell, executable, or script) on an external server and instructs the vulnerable method to retrieve it.

Because the file is stored without proper validation, the attacker can then access or trigger the uploaded malicious file to achieve code execution. The SYSTEM-level execution context means the attacker gains complete control over the affected system.

For detailed technical information, refer to the Zero Day Initiative Advisory ZDI-25-464.

Detection Methods for CVE-2025-6802

Indicators of Compromise

• Unexpected files appearing in web-accessible directories of QConvergeConsole installation
• Web server logs showing requests to the getFileFromURL endpoint with external URLs
• Presence of web shells or suspicious script files (.jsp, .war, .exe) in application directories
• Unusual outbound connections from the QConvergeConsole server to external hosts

Detection Strategies

• Monitor HTTP requests to QConvergeConsole for calls to the getFileFromURL method containing external URL parameters
• Implement file integrity monitoring on QConvergeConsole installation directories to detect unauthorized file creation
• Analyze web server access logs for anomalous patterns targeting file upload functionality
• Deploy endpoint detection rules to identify SYSTEM-level process spawning from QConvergeConsole services

Monitoring Recommendations

• Enable verbose logging on QConvergeConsole to capture all API method invocations
• Configure network monitoring to alert on the QConvergeConsole server making unexpected outbound HTTP requests
• Implement real-time alerting for new file creation in web application directories
• Monitor for execution of unexpected child processes spawned by QConvergeConsole service accounts

How to Mitigate CVE-2025-6802

Immediate Actions Required

• Restrict network access to QConvergeConsole management interfaces to trusted IP addresses only
• Implement network segmentation to isolate systems running QConvergeConsole from untrusted networks
• Deploy web application firewall rules to block suspicious requests to the getFileFromURL endpoint
• Audit existing QConvergeConsole installations for signs of compromise before applying mitigations

Patch Information

Monitor Marvell's official security communications and the Zero Day Initiative Advisory ZDI-25-464 for patch availability. Apply vendor-supplied security updates as soon as they become available.

Workarounds

• Disable or restrict access to the getFileFromURL method if not required for operations
• Place QConvergeConsole behind a reverse proxy with strict URL filtering to block external URL parameters
• Implement network-level controls to prevent the QConvergeConsole server from making outbound HTTP connections
• Run QConvergeConsole under a service account with minimal privileges where possible to limit impact

# Example: Restrict network access to QConvergeConsole using Windows Firewall
# Block inbound connections except from trusted management subnet
netsh advfirewall firewall add rule name="Block QConvergeConsole External" dir=in action=block program="C:\Program Files\QConvergeConsole\qcc.exe"
netsh advfirewall firewall add rule name="Allow QConvergeConsole Trusted" dir=in action=allow program="C:\Program Files\QConvergeConsole\qcc.exe" remoteip=10.0.0.0/24